Notes from the assessor's chair

This blog covers the operational side of PCI assessment: how QSA firms run engagements, what changes when AI assists with drafting, and what it takes to stand behind a report long after it ships.

What to expect

A few commitments about what you’ll read here:

• Written from practice. The questions come from assessor work, not from a content calendar: the consent conversation at scoping, the evidence that doesn’t support the claim, the QA pass that catches a determination drifting from its testing.

• Assessor-side only. Merchant and service-provider compliance is well covered elsewhere. We write for the firm performing the assessment: the people who examine the evidence, make the determinations, and sign the report.

• Sources named. When a post leans on a PCI SSC document, we name the document and quote it precisely, starting with “Integrating Artificial Intelligence in PCI Assessments” (Guidelines v1.0, March 2025).

• No pitches. Articles are for working assessors first. Where Enpasse is relevant we say so plainly, and that’s the extent of it.

Topics on the slate: client consent for AI-assisted engagements, what “suggested wording” means in day-to-day practice, treating AQM readiness as a record-keeping habit rather than a year-end project, and human-in-the-loop QA that holds up to review.

If that’s your work, we hope this earns a place in your reading.